HTML

生成元originの有効ドメインは、次のように計算される：

1. originが不透明な生成元である場合、nullを返す。

2. originのドメインがnullでない場合、originのドメインを返す。

3. originのホストを返す。

The serialization of an origin is the string obtained by applying the following algorithm to the given origin origin:

1. If origin is an opaque origin, then return "null".

2. Otherwise, let result be origin's scheme.

3. Append "://" to result.

4. Append origin's host, serialized, to result.

5. If origin's port is non-null, append a U+003A COLON character (:), and origin's port, serialized, to result.

6. Return result.

Two origins, A and B, are said to be same origin if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins and their schemes, hosts, and port are identical, then return true.

3. falseを返す。

Two origins, A and B, are said to be same origin-domain if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins:

   1. If A and B's schemes are identical, and their domains are identical and non-null, then return true.

   2. Otherwise, if A and B are same origin and their domains are both null, return true.

3. falseを返す。

To obtain a site, given an origin origin, run these steps:

1. If origin is an opaque origin, then return origin.

2. If origin's host's registrable domain is null, then return (origin's scheme, origin's host).

3. Return (origin's scheme, origin's host's registrable domain).

Two sites, A and B, are said to be same site if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A or B is an opaque origin, then return false.

3. If A's and B's scheme values are different, then return false.

4. If A's and B's host values are not equal, then return false.

5. Return true.

The serialization of a site is the string obtained by applying the following algorithm to the given site site:

1. If site is an opaque origin, then return "null".

2. Let result be site[0].

3. Append "://" to result.

4. Append site[1], serialized, to result.

5. Return result.

Two origins, A and B, are said to be schemelessly same site if the following algorithm returns true:

1. If A and B are the same opaque origin, then return true.

2. If A and B are both tuple origins:

   1. Let hostA be A's host, and let hostB be B's host.

   2. If hostA equals hostB and hostA's registrable domain is null, then return true.

   3. If hostA's registrable domain equals hostB's registrable domain and is non-null, then return true.

3. falseを返す。

Two origins, A and B, are said to be same site if the following algorithm returns true:

1. Let siteA be the result of obtaining a site given A.

2. Let siteB be the result of obtaining a site given B.

3. If siteA is same site with siteB, then return true.

4. falseを返す。

The domain getter steps are:

1. Let effectiveDomain be this's origin's effective domain.

2. If effectiveDomain is null, then return the empty string.

3. Return effectiveDomain, serialized.

The domain setter steps are:

1. If this's browsing context is null, then throw a "SecurityError" DOMException.

2. If this's active sandboxing flag set has its sandboxed document.domain browsing context flag set, then throw a "SecurityError" DOMException.

3. Let effectiveDomain be this's origin's effective domain.

4. If effectiveDomain is null, then throw a "SecurityError" DOMException.

5. If the given value is not a registrable domain suffix of and is not equal to effectiveDomain, then throw a "SecurityError" DOMException.

6. If the surrounding agent's agent cluster's is origin-keyed is true, then return.

7. Set this's origin's domain to the result of parsing the given value.

To determine if a scalar value string hostSuffixString is a registrable domain suffix of or is equal to a host originalHost:

1. If hostSuffixString is the empty string, then return false.

2. Let hostSuffix be the result of parsing hostSuffixString.

3. If hostSuffix is failure, then return false.

4. If hostSuffix does not equal originalHost:

   1. If hostSuffix or originalHost is not a domain, then return false.

      This excludes hosts that are IP addresses.

   2. If hostSuffix, prefixed by U+002E (.), does not match the end of originalHost, then return false.

   3. If any of the following are true:

      • hostSuffix equals hostSuffix's public suffix; or

      • hostSuffix, prefixed by U+002E (.), matches the end of originalHost's public suffix,

      then return false. [URL]

   4. Assert: originalHost's public suffix, prefixed by U+002E (.), matches the end of hostSuffix.

5. Return true.

Objects implementing the Origin interface's extract an origin steps are to return this's origin.

The new Origin() constructor steps are to set this's origin to a unique opaque origin.

The static from(value) method steps are:

1. If value is a platform object:

   1. Let origin be the result of executing value's extract an origin operation.

   2. If origin is not null, then return a new Origin object whose origin is origin.

2. If value is a string:

   1. Let parsedURL be the result of basic URL parsing value.

   2. If parsedURL is not failure, then return a new Origin object whose origin is set to parsedURL's origin.

3. Throw a TypeError.

The opaque getter steps are to return true if this's origin is an opaque origin; otherwise false.

The isSameOrigin(other) method steps are to return true if this's origin is same origin with other's origin; otherwise false.

The isSameSite(other) method steps are to return true if this's origin is same site with other's origin; otherwise false.

The originAgentCluster getter steps are to return the surrounding agent's agent cluster's is origin-keyed.

To match opener policy values, given an opener policy value documentCOOP, an origin documentOrigin, an opener policy value responseCOOP, and an origin responseOrigin:

1. If documentCOOP is "unsafe-none" and responseCOOP is "unsafe-none", then return true.

2. If documentCOOP is "unsafe-none" or responseCOOP is "unsafe-none", then return false.

3. If documentCOOP is responseCOOP and documentOrigin is same origin with responseOrigin, then return true.

4. falseを返す。

To obtain an opener policy given a response response and an environment reservedEnvironment:

1. Let policy be a new opener policy.

2. If reservedEnvironment is a non-secure context, then return policy.

3. Let parsedItem be the result of getting a structured field value given `Cross-Origin-Opener-Policy` and "item" from response's header list.

4. If parsedItem is not null:

   1. If parsedItem[0] is "same-origin":

      1. Let coep be the result of obtaining a cross-origin embedder policy from response and reservedEnvironment.

      2. If coep's value is compatible with cross-origin isolation, then set policy's value to "same-origin-plus-COEP".

      3. Otherwise, set policy's value to "same-origin".

   2. If parsedItem[0] is "same-origin-allow-popups", then set policy's value to "same-origin-allow-popups".

   3. If parsedItem[0] is "noopener-allow-popups", then set policy's value to "noopener-allow-popups".

   4. If parsedItem[1]["report-to"] exists and it is a string, then set policy's reporting endpoint to parsedItem[1]["report-to"].

5. Set parsedItem to the result of getting a structured field value given `Cross-Origin-Opener-Policy-Report-Only` and "item" from response's header list.

6. If parsedItem is not null:

   1. If parsedItem[0] is "same-origin":

      1. Let coep be the result of obtaining a cross-origin embedder policy from response and reservedEnvironment.

      2. If coep's value is compatible with cross-origin isolation or coep's report-only value is compatible with cross-origin isolation, then set policy's report-only value to "same-origin-plus-COEP".

         Report only COOP also considers report-only COEP to assign the special "same-origin-plus-COEP" value. This allows developers more freedom in the order of deployment of COOP and COEP.

      3. Otherwise, set policy's report-only value to "same-origin".

   2. If parsedItem[0] is "same-origin-allow-popups", then set policy's report-only value to "same-origin-allow-popups".

   3. If parsedItem[1]["report-to"] exists and it is a string, then set policy's report-only reporting endpoint to parsedItem[1]["report-to"].

7. Return policy.

To check if popup COOP values require a browsing context group switch, given two origins responseOrigin and activeDocumentNavigationOrigin, and two opener policy values responseCOOPValue and activeDocumentCOOPValue:

1. If responseCOOPValue is "noopener-allow-popups", then return true.

2. If all of the following are true:

   • activeDocumentCOOPValue's value is "same-origin-allow-popups" or "noopener-allow-popups"; and

   • responseCOOPValue is "unsafe-none",

   then return false.

3. If the result of matching activeDocumentCOOPValue, activeDocumentNavigationOrigin, responseCOOPValue, and responseOrigin is true, then return false.

4. Return true.

To check if COOP values require a browsing context group switch, given a boolean isInitialAboutBlank, two origins responseOrigin and activeDocumentNavigationOrigin, and two opener policy values responseCOOPValue and activeDocumentCOOPValue:

1. If isInitialAboutBlank is true, then return the result of checking if popup COOP values requires a browsing context group switch with responseOrigin, activeDocumentNavigationOrigin, responseCOOPValue, and activeDocumentCOOPValue.

2. Here we are dealing with a non-popup navigation.

   If the result of matching activeDocumentCOOPValue, activeDocumentNavigationOrigin, responseCOOPValue, and responseOrigin is true, then return false.

3. Return true.

To check if enforcing report-only COOP would require a browsing context group switch, given a boolean isInitialAboutBlank, two origins responseOrigin, activeDocumentNavigationOrigin, and two opener policies responseCOOP and activeDocumentCOOP:

1. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's report-only value, and activeDocumentCOOPReportOnly's report-only value is false, then return false.

   Matching report-only policies allows a website to specify the same report-only opener policy on all its pages and not receive violation reports for navigations between these pages.

2. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's value, and activeDocumentCOOPReportOnly's report-only value is true, then return true.

3. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, responseOrigin, activeDocumentNavigationOrigin, responseCOOP's report-only value, and activeDocumentCOOPReportOnly's value is true, then return true.

4. falseを返す。

To enforce a response's opener policy, given a browsing context browsingContext, a URL responseURL, an origin responseOrigin, an opener policy responseCOOP, an opener policy enforcement result currentCOOPEnforcementResult, and a referrer referrer:

1. Let newCOOPEnforcementResult be a new opener policy enforcement result with

   needs a browsing context group switch

   currentCOOPEnforcementResult's needs a browsing context group switch

   would need a browsing context group switch due to report-only

   currentCOOPEnforcementResult's would need a browsing context group switch due to report-only

   url

   responseURL

   origin

   responseOrigin

   opener policy

   responseCOOP

   current context is navigation source

   true

2. Let isInitialAboutBlank be browsingContext's active document's is initial about:blank.

3. If isInitialAboutBlank is true and browsingContext's initial URL is null, set browsingContext's initial URL to responseURL.

4. If the result of checking if COOP values require a browsing context group switch given isInitialAboutBlank, currentCOOPEnforcementResult's opener policy's value, currentCOOPEnforcementResult's origin, responseCOOP's value, and responseOrigin is true:

   1. Set newCOOPEnforcementResult's needs a browsing context group switch to true.

   2. If browsingContext's group's browsing context set's size is greater than 1:

      1. Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "enforce", responseURL, currentCOOPEnforcementResult's url, currentCOOPEnforcementResult's origin, responseOrigin, and referrer.

      2. Queue a violation report for browsing context group switch when navigating away from a COOP response with currentCOOPEnforcementResult's opener policy, "enforce", currentCOOPEnforcementResult's url, responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and currentCOOPEnforcementResult's current context is navigation source.

5. If the result of checking if enforcing report-only COOP would require a browsing context group switch given isInitialAboutBlank, responseOrigin, currentCOOPEnforcementResult's origin, responseCOOP, and currentCOOPEnforcementResult's opener policy, is true:

   1. Set newCOOPEnforcementResult's would need a browsing context group switch due to report-only to true.

   2. If browsingContext's group's browsing context set's size is greater than 1:

      1. Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "reporting", responseURL, currentCOOPEnforcementResult's url, currentCOOPEnforcementResult's origin, responseOrigin, and referrer.

      2. Queue a violation report for browsing context group switch when navigating away from a COOP response with currentCOOPEnforcementResult's opener policy, "reporting", currentCOOPEnforcementResult's url, responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and currentCOOPEnforcementResult's current context is navigation source.

6. Return newCOOPEnforcementResult.

To obtain a browsing context to use for a navigation response, given navigation params navigationParams:

1. Let browsingContext be navigationParams's navigable's active browsing context.

2. If browsingContext is not a top-level browsing context, then return browsingContext.

3. Let coopEnforcementResult be navigationParams's COOP enforcement result.

4. Let swapGroup be coopEnforcementResult's needs a browsing context group switch.

5. Let sourceOrigin be browsingContext's active document's origin.

6. Let destinationOrigin be navigationParams's origin.

7. If sourceOrigin is not same site with destinationOrigin:

   1. If either of sourceOrigin or destinationOrigin have a scheme that is not an HTTP(S) scheme and the user agent considers it necessary for sourceOrigin and destinationOrigin to be isolated from each other (for implementation-defined reasons), optionally set swapGroup to true.

      For example, if a user navigates from about:settings to https://example.com, the user agent could force a swap.

      Issue #10842 tracks settling on an interoperable behavior here, instead of letting this be optional.

   2. If navigationParams's user involvement is "browser UI", optionally set swapGroup to true.

      Issue #6356 tracks settling on an interoperable behavior here, instead of letting this be optional.

8. If browsingContext's group's browsing context set's size is 1, optionally set swapGroup to true.

   Some implementations swap browsing context groups here for performance reasons.

   The check for other contexts that could script this one is not sufficient to prevent differences in behavior that could affect a web page. Even if there are currently no other contexts, the destination page could open a window, then if the user navigates back, the previous page could expect to be able to script the opened window. Doing a swap here would break that use case.

9. If swapGroup is false:

   1. If coopEnforcementResult's would need a browsing context group switch due to report-only is true, set browsingContext's virtual browsing context group ID to a new unique identifier.

   2. Return browsingContext.

10. Let newBrowsingContext be the first return value of creating a new top-level browsing context and document.

    In this case we are going to perform a browsing context group swap. browsingContext will not be used by the new Document that we are about to create. If it is not used by other Documents either (such as ones in the back/forward cache), then the user agent might destroy it at this point.

11. Let navigationCOOP be navigationParams's cross-origin opener policy.

12. If navigationCOOP's value is "same-origin-plus-COEP", then set newBrowsingContext's group's cross-origin isolation mode to either "logical" or "concrete". The choice of which is implementation-defined.

    It is difficult on some platforms to provide the security properties required by the cross-origin isolated capability. "concrete" grants access to it and "logical" does not.

13. Let sandboxFlags be a clone of navigationParams's final sandboxing flag set.

14. If sandboxFlags is not empty:

    1. Assert: navigationCOOP's value is "unsafe-none".

    2. Assert: newBrowsingContext's popup sandboxing flag set is empty.

    3. Set newBrowsingContext's popup sandboxing flag set to sandboxFlags.

15. Return newBrowsingContext.

To check if an access between two browsing contexts should be reported, given two browsing contexts accessor and accessed, a JavaScript property name P, and an environment settings object environment:

1. If P is not a cross-origin accessible window property name, then return.

2. Assert: accessor's active document and accessed's active document are both fully active.

3. Let accessorTopDocument be accessor's top-level browsing context's active document.

4. Let accessorInclusiveAncestorOrigins be the list obtained by taking the origin of the active document of each of accessor's active document's inclusive ancestor navigables.

5. Let accessedTopDocument be accessed's top-level browsing context's active document.

6. Let accessedInclusiveAncestorOrigins be the list obtained by taking the origin of the active document of each of accessed's active document's inclusive ancestor navigables.

7. If any of accessorInclusiveAncestorOrigins are not same origin with accessorTopDocument's origin, or if any of accessedInclusiveAncestorOrigins are not same origin with accessedTopDocument's origin, then return.

   This avoids leaking information about cross-origin iframes to a top level frame with opener policy reporting.

8. If accessor's top-level browsing context's virtual browsing context group ID is accessed's top-level browsing context's virtual browsing context group ID, then return.

9. Let accessorAccessedRelationship be a new accessor-accessed relationship with value none.

10. If accessed's top-level browsing context's opener browsing context is accessor or is an ancestor of accessor, then set accessorAccessedRelationship to accessor is opener.

11. If accessor's top-level browsing context's opener browsing context is accessed or is an ancestor of accessed, then set accessorAccessedRelationship to accessor is openee.

12. Queue violation reports for accesses, given accessorAccessedRelationship, accessorTopDocument's opener policy, accessedTopDocument's opener policy, accessor's active document's URL, accessed's active document's URL, accessor's top-level browsing context's initial URL, accessed's top-level browsing context's initial URL, accessor's active document's origin, accessed's active document's origin, accessor's top-level browsing context's opener origin at creation, accessed's top-level browsing context's opener origin at creation, accessorTopDocument's referrer, accessedTopDocument's referrer, P, and environment.

To sanitize a URL to send in a report given a URL url:

1. Let sanitizedURL be a copy of url.

2. Set the username given sanitizedURL and the empty string.

3. Set the password given sanitizedURL and the empty string.

4. Return the serialization of sanitizedURL with exclude fragment set to true.

To queue a violation report for browsing context group switch when navigating to a COOP response given an opener policy coop, a string disposition, a URL coopURL, a URL previousResponseURL, two origins coopOrigin and previousResponseOrigin, and a referrer referrer:

1. If coop's reporting endpoint is null, return.

2. Let coopValue be coop's value.

3. If disposition is "reporting", then set coopValue to coop's report-only value.

4. Let serializedReferrer be an empty string.

5. If referrer is a URL, set serializedReferrer to the serialization of referrer.

6. Let body be a new object containing the following properties:

   key	value
   disposition	disposition
   effectivePolicy	coopValue
   previousResponseURL	If coopOrigin and previousResponseOrigin are same origin this is the sanitization of previousResponseURL, null otherwise.
   referrer	serializedReferrer
   type	"navigation-to-response"

7. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue a violation report for browsing context group switch when navigating away from a COOP response given an opener policy coop, a string disposition, a URL coopURL, a URL nextResponseURL, two origins coopOrigin and nextResponseOrigin, and a boolean isCOOPResponseNavigationSource:

1. If coop's reporting endpoint is null, return.

2. Let coopValue be coop's value.

3. If disposition is "reporting", then set coopValue to coop's report-only value.

4. Let body be a new object containing the following properties:

   key	value
   disposition	disposition
   effectivePolicy	coopValue
   nextResponseURL	If coopOrigin and nextResponseOrigin are same origin or isCOOPResponseNavigationSource is true, this is the sanitization of nextResponseURL, null otherwise.
   type	"navigation-from-response"

5. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue violation reports for accesses, given an accessor-accessed relationship accessorAccessedRelationship, two opener policies accessorCOOP and accessedCOOP, four URLs accessorURL, accessedURL, accessorInitialURL, accessedInitialURL, four origins accessorOrigin, accessedOrigin, accessorCreatorOrigin and accessedCreatorOrigin, two referrers accessorReferrer and accessedReferrer, a string propertyName, and an environment settings object environment:

1. If coop's reporting endpoint is null, return.

2. Let coopValue be coop's value.

3. If disposition is "reporting", then set coopValue to coop's report-only value.

4. If accessorAccessedRelationship is accessor is opener:

   1. Queue a violation report for access to an opened window, given accessorCOOP, accessorURL, accessedURL, accessedInitialURL, accessorOrigin, accessedOrigin, accessedCreatorOrigin, propertyName, and environment.

   2. Queue a violation report for access from the opener, given accessedCOOP, accessedURL, accessorURL, accessedOrigin, accessorOrigin, propertyName, and accessedReferrer.

5. Otherwise, if accessorAccessedRelationship is accessor is openee:

   1. Queue a violation report for access to the opener, given accessorCOOP, accessorURL, accessedURL, accessorOrigin, accessedOrigin, propertyName, accessorReferrer, and environment.

   2. Queue a violation report for access from an opened window, given accessedCOOP, accessedURL, accessorURL, accessorInitialURL, accessedOrigin, accessorOrigin, accessorCreatorOrigin, and propertyName.

6. Otherwise:

   1. Queue a violation report for access to another window, given accessorCOOP, accessorURL, accessedURL, accessorOrigin, accessedOrigin, propertyName, and environment.

   2. Queue a violation report for access from another window, given accessedCOOP, accessedURL, accessorURL, accessedOrigin, accessorOrigin, and propertyName.

To queue a violation report for access to the opener, given an opener policy coop, two URLs coopURL and openerURL, two origins coopOrigin and openerOrigin, a string propertyName, a referrer referrer, and an environment settings object environment:

1. Let sourceFile, lineNumber, and columnNumber be the relevant script URL and problematic position which triggered this report.

2. Let serializedReferrer be an empty string.

3. If referrer is a URL, set serializedReferrer to the serialization of referrer.

4. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openerURL	If coopOrigin and openerOrigin are same origin, this is the sanitization of openerURL, null otherwise.
   referrer	serializedReferrer
   sourceFile	sourceFile
   lineNumber	lineNumber
   columnNumber	columnNumber
   type	"access-to-opener"

5. Queue body as "coop" for coop's reporting endpoint with coopURL and environment.

To queue a violation report for access to an opened window, given an opener policy coop, three URLs coopURL, openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and openerInitialOrigin, a string propertyName, and an environment settings object environment:

1. Let sourceFile, lineNumber, and columnNumber be the relevant script URL and problematic position which triggered this report.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openedWindowURL	If coopOrigin and openedWindowOrigin are same origin, this is the sanitization of openedWindowURL, null otherwise.
   openedWindowInitialURL	If coopOrigin and openerInitialOrigin are same origin, this is the sanitization of initialWindowURL, null otherwise.
   sourceFile	sourceFile
   lineNumber	lineNumber
   columnNumber	columnNumber
   type	"access-to-opener"

3. Queue body as "coop" for coop's reporting endpoint with coopURL and environment.

To queue a violation report for access to another window, given an opener policy coop, two URLs coopURL and otherURL, two origins coopOrigin and otherOrigin, a string propertyName, and an environment settings object environment:

1. Let sourceFile, lineNumber, and columnNumber be the relevant script URL and problematic position which triggered this report.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   otherURL	If coopOrigin and otherOrigin are same origin, this is the sanitization of otherURL, null otherwise.
   sourceFile	sourceFile
   lineNumber	lineNumber
   columnNumber	columnNumber
   type	"access-to-opener"

3. Queue body as "coop" for coop's reporting endpoint with coopURL and environment.

To queue a violation report for access from the opener, given an opener policy coop, two URLs coopURL and openerURL, two origins coopOrigin and openerOrigin, a string propertyName, and a referrer referrer:

1. If coop's reporting endpoint is null, return.

2. Let serializedReferrer be an empty string.

3. If referrer is a URL, set serializedReferrer to the serialization of referrer.

4. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   openerURL	If coopOrigin and openerOrigin are same origin, this is the sanitization of openerURL, null otherwise.
   referrer	serializedReferrer
   type	"access-to-opener"

5. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue a violation report for access from an opened window, given an opener policy coop, three URLs coopURL, openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and openerInitialOrigin, and a string propertyName:

1. If coop's reporting endpoint is null, return.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coopValue
   property	coop's report-only value
   openedWindowURL	If coopOrigin and openedWindowOrigin are same origin, this is the sanitization of openedWindowURL, null otherwise.
   openedWindowInitialURL	If coopOrigin and openerInitialOrigin are same origin, this is the sanitization of initialWindowURL, null otherwise.
   type	"access-to-opener"

3. Queue body as "coop" for coop's reporting endpoint with coopURL.

To queue a violation report for access from another window, given an opener policy coop, two URLs coopURL and otherURL, two origins coopOrigin and otherOrigin, and a string propertyName:

1. If coop's reporting endpoint is null, return.

2. Let body be a new object containing the following properties:

   key	value
   disposition	"reporting"
   effectivePolicy	coop's report-only value
   property	propertyName
   otherURL	If coopOrigin and otherOrigin are same origin, this is the sanitization of otherURL, null otherwise.
   type	access-to-opener

3. Queue body as "coop" for coop's reporting endpoint with coopURL.

エンベッダーポリシー値は、"credentialless"または"require-corp"である場合、生成元をまたいだ分離と互換性がある。

To obtain an embedder policy from a response response and an environment environment:

1. Let policy be a new embedder policy.

2. If environment is a non-secure context, then return policy.

3. Let parsedItem be the result of getting a structured field value with `Cross-Origin-Embedder-Policy` and "item" from response's header list.

4. If parsedItem is non-null and parsedItem[0] is compatible with cross-origin isolation:

   1. Set policy's value to parsedItem[0].

   2. If parsedItem[1]["report-to"] exists, then set policy's reporting endpoint to parsedItem[1]["report-to"].

5. Set parsedItem to the result of getting a structured field value with `Cross-Origin-Embedder-Policy-Report-Only` and "item" from response's header list.

6. If parsedItem is non-null and parsedItem[0] is compatible with cross-origin isolation:

   1. Set policy's report-only value to parsedItem[0].

   2. If parsedItem[1]["report-to"] exists, then set policy's report-only reporting endpoint to parsedItem[1]["report-to"].

7. Return policy.

To check a navigation response's adherence to its embedder policy given a response response, a navigable navigable, and an embedder policy responsePolicy:

1. If navigable is not a child navigable, then return true.

2. Let parentPolicy be navigable's container document's policy container's embedder policy.

3. If parentPolicy's report-only value is compatible with cross-origin isolation and responsePolicy's value is not, then queue a cross-origin embedder policy inheritance violation with response, "navigation", parentPolicy's report-only reporting endpoint, "reporting", and navigable's container document's relevant settings object.

4. If parentPolicy's value is not compatible with cross-origin isolation or responsePolicy's value is compatible with cross-origin isolation, then return true.

5. Queue a cross-origin embedder policy inheritance violation with response, "navigation", parentPolicy's reporting endpoint, "enforce", and navigable's container document's relevant settings object.

6. falseを返す。

To check a global object's embedder policy given a WorkerGlobalScope workerGlobalScope, an environment settings object owner, and a response response:

1. If workerGlobalScope is not a DedicatedWorkerGlobalScope object, then return true.

2. Let policy be workerGlobalScope's embedder policy.

3. Let ownerPolicy be owner's policy container's embedder policy.

4. If ownerPolicy's report-only value is compatible with cross-origin isolation and policy's value is not, then queue a cross-origin embedder policy inheritance violation with response, "worker initialization", ownerPolicy's report-only reporting endpoint, "reporting", and owner.

5. If ownerPolicy's value is not compatible with cross-origin isolation or policy's value is compatible with cross-origin isolation, then return true.

6. Queue a cross-origin embedder policy inheritance violation with response, "worker initialization", ownerPolicy's reporting endpoint, "enforce", and owner.

7. falseを返す。

To queue a cross-origin embedder policy inheritance violation given a response response, a string type, a string endpoint, a string disposition, and an environment settings object settings:

1. Let serialized be the result of serializing a response URL for reporting with response.

2. Let body be a new object containing the following properties:

   key	value
   type	type
   blockedURL	serialized
   disposition	disposition

3. Queue body as the "coep" report type for endpoint on settings.

When the user agent is to parse a sandboxing directive, given a string input and a sandboxing flag set output, it must run the following steps:

1. Split input on ASCII whitespace, to obtain tokens.

2. outputを空にする。

3. outputに次のフラグを追加する：

   • サンドボックス化されたナビゲーションブラウジングコンテキストフラグ

   • tokensがallow-popupsキーワードを含む場合を除いて、サンドボックス化された補助ナビゲーションブラウジングコンテキストフラグ

   • The sandboxed top-level navigation without user activation browsing context flag, unless tokens contains the allow-top-navigation keyword.

   • The sandboxed top-level navigation with user activation browsing context flag, unless tokens contains either the allow-top-navigation-by-user-activation keyword or the allow-top-navigation keyword.

     This means that if the allow-top-navigation is present, the allow-top-navigation-by-user-activation keyword will have no effect. For this reason, specifying both is a document conformance error.

   • tokensがallow-same-originキーワードを含む場合を除いて、サンドボックス化された生成元ブラウジングコンテキストフラグ

     allow-same-originキーワードは2つの例を対象とする。

     1つ目は、依然としてサンドボックス化されたコンテンツのDOMへのアクセスを可能する一方で、スクリプトを無効にするためにサンドボックス化されるべき同じサイトからコンテンツを許可するために使用できる。

     2つ目は、サードパーティサイトからコンテンツを埋め込むために使用でき、データなどを格納するためにデータベースAPIを使用して、その元のサイトに戻る通信から埋め込まれたページを妨げることなく、ポップアップなどを開いてから、そのサイトを防ぐためにサンドボックス化する。

   • tokensがallow-formsキーワードを含む場合を除いて、サンドボックス化されたフォームブラウジングコンテキストフラグ

   • tokensがallow-pointer-lockキーワードを含む場合を除いて、サンドボックス化されたポインターロックブラウジングコンテキストフラグ

   • tokensがallow-scriptsキーワードを含む場合を除いて、サンドボックス化されたスクリプトブラウジングコンテキストフラグ

   • tokensが（上記で定義された）allow-scriptsキーワードを含む場合を除いて、サンドボックス化された自動機能ブラウジングコンテキストフラグ

     このフラグは、スクリプトと同じキーワードで緩和される。なぜなら、スクリプトが有効である場合にこれらの機能はいずれにせよ些細なことで実行でき、宣言的な機能を使用できるようにするよりむしろサンドボックス化された場合に、著者がそれら機能を実行するためのスクリプトを使用するよう強制することが不幸であるためである。

   • サンドボックス化されたdocument.domainブラウジングコンテキストフラグ。

   • The sandbox propagates to auxiliary browsing contexts flag, unless tokens contains the allow-popups-to-escape-sandbox keyword.

   • The sandboxed modals flag, unless tokens contains the allow-modals keyword.

   • The sandboxed orientation lock browsing context flag, unless tokens contains the allow-orientation-lock keyword.

   • The sandboxed presentation browsing context flag, unless tokens contains the allow-presentation keyword.

   • The sandboxed downloads browsing context flag, unless tokens contains the allow-downloads keyword.

   • The sandboxed custom protocols navigation browsing context flag, unless tokens contains either the allow-top-navigation-to-custom-protocols keyword, the allow-popups keyword, or the allow-top-navigation keyword.

Every CSP list cspList has CSP-derived sandboxing flags, which is a sandboxing flag set. It is the return value of the following algorithm:

1. Let directives be an empty ordered set.

2. For each policy in cspList:

   1. If policy's disposition is not "enforce", then continue.

   2. If policy's directive set contains a directive whose name is "sandbox", then append that directive to directives.

3. If directives is empty, then return an empty sandboxing flag set.

4. Let directive be directives[directives's size − 1].

5. Return the result of parsing the sandboxing directive directive.

nullまたは要素embedderを指定して、ブラウジングコンテキストbrowsing contextの作成サンドボックスフラグを決定するには、次のサンドボックスフラグセットに存在するフラグの和集合を返す。

• If embedder is null, then the flags set on browsing context's popup sandboxing flag set.

• If embedder is an element, then the flags set on embedder's iframe sandboxing flag set.

• If embedder is an element, then the flags set on embedder's node document's active sandboxing flag set.

To determine the iframe element referrer policy given an element-or-null embedder:

1. If embedder is an iframe element, then return embedder's referrerpolicy attribute's state's corresponding keyword.

2. 空文字列を返す。

To clone a policy container given a policy container policyContainer:

1. Let clone be a new policy container.

2. For each policy in policyContainer's CSP list, append a copy of policy into clone's CSP list.

3. Set clone's embedder policy to a copy of policyContainer's embedder policy.

4. Set clone's referrer policy to policyContainer's referrer policy.

5. Set clone's integrity policy to a copy of policyContainer's integrity policy.

6. Return clone.

To determine whether a URL url requires storing the policy container in history:

1. If url's scheme is "blob", then return false.

2. If url is local, then return true.

3. falseを返す。

To create a policy container from a fetch response given a response response and an environment-or-null environment:

1. If response's URL's scheme is "blob", then return a clone of response's URL's blob URL entry's environment's policy container.

2. Let result be a new policy container.

3. Set result's CSP list to the result of parsing a response's Content Security Policies given response.

4. If environment is non-null, then set result's embedder policy to the result of obtaining an embedder policy given response and environment. Otherwise, set it to "unsafe-none".

5. Set result's referrer policy to the result of parsing the `Referrer-Policy` header given response. [REFERRERPOLICY]

6. Parse Integrity-Policy headers with response and result.

7. Return result.

To determine navigation params policy container given a URL responseURL and four policy container-or-nulls historyPolicyContainer, initiatorPolicyContainer, parentPolicyContainer, and responsePolicyContainer:

1. If historyPolicyContainer is not null:

   1. Assert: responseURL requires storing the policy container in history.

   2. Return a clone of historyPolicyContainer.

2. If responseURL is about:srcdoc:

   1. Assert: parentPolicyContainer is not null.

   2. Return a clone of parentPolicyContainer.

3. If responseURL is local and initiatorPolicyContainer is not null, then return a clone of initiatorPolicyContainer.

4. If responsePolicyContainer is not null, then return responsePolicyContainer.

5. Return a new policy container.

To initialize a worker global scope's policy container given a WorkerGlobalScope workerGlobalScope, a response response, and an environment environment:

1. If workerGlobalScope's url is local but its scheme is not "blob":

   1. Assert: workerGlobalScope's owner set's size is 1.

   2. Set workerGlobalScope's policy container to a clone of workerGlobalScope's owner set[0]'s relevant settings object's policy container.

2. Otherwise, set workerGlobalScope's policy container to the result of creating a policy container from a fetch response given response and environment.